Weaknesses of type CWE-288

620 results

Controle de acesso inadequado

A aplicação não valida corretamente quem pode acessar um recurso, função ou dado sensível. O atacante consegue contornar as verificações de autenticação ou autorização e executa ações não permitidas (ler dados de outro usuário, modificar configurações críticas, etc.). Essa é uma das falhas mais comuns e perigosas em desenvolvimento web e APIs.

Example

Uma API de banco de dados retorna dados do usuário ID 123 quando você requisita `/api/users/123`, mas não verifica se você é realmente o dono desse perfil ou um admin. Um atacante muda o ID na URL para `/api/users/456` e acessa dados de outro cliente sem nenhuma barreira.

How to mitigate

Sempre valide a identidade do usuário (autenticação) e depois confirme explicitamente se ele tem permissão para aquele recurso (autorização). Use tokens seguros, implemente controle de acesso baseado em papéis ou atributos, e teste cada endpoint com usuários diferentes para garantir que um não acessa dados do outro.

CVE-2023-42793CRITICALIn JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possibleEPSS 100.0%KEVCVE-2024-1709CRITICALAuthentication bypass using an alternate path or channelEPSS 100.0%KEVCVE-2024-27198CRITICALIn JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleEPSS 99.9%KEVCVE-2025-4427MEDIUMAuthentication BypassEPSS 99.9%KEVCVE-2024-55591CRITICALAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiEPSS 98.3%KEVCVE-2023-46747CRITICALBIG-IP Configuration utility unauthenticated remote code execution vulnerabilityEPSS 96.5%KEVCVE-2026-23760CRITICALSmarterTools SmarterMail < Build 9511 Authentication Bypass via Password Reset APIEPSS 96.3%KEVCVE-2025-2747CRITICALKentico Xperience <= 13.0.178 Staging Sync Server None Password Type Authentication BypassEPSS 92.2%KEVCVE-2020-10148CRITICALSolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commandsEPSS 92.0%KEVCVE-2025-57819CRITICALFreePBX Affected by Authentication Bypass Leading to SQL Injection and RCEEPSS 88.3%KEVCVE-2026-24858CRITICALAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.EPSS 85.8%KEVCVE-2025-34026CRITICALVersa Concerto Actuator Authentication Bypass Information LeakEPSS 83.1%KEVCVE-2024-10924CRITICALReally Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication BypassEPSS 81.7%CVE-2026-1603HIGHAn authentication bypass in Ivanti Endpoint Manager before version 2024 SU5 allows a remote unauthenticated attacker to leak specific storedEPSS 80.6%KEVCVE-2024-56325CRITICALApache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredEPSS 78.7%CVE-2023-2732CRITICALMStore API <= 3.9.2 - Authentication BypassEPSS 67.5%CVE-2024-13179HIGHPath Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.EPSS 61.8%CVE-2022-35869HIGHThis vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022EPSS 60.3%CVE-2025-2746CRITICALKentico Xperience <= 13.0.172 Staging Sync Server Digest Password Authentication BypassEPSS 58.4%KEVCVE-2024-23917CRITICALIn JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possibleEPSS 53.7%